EEF-CVE-2026-23939
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-23939.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-23939.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-23939
- Aliases
-
- CVE-2026-23939
- GHSA-42mv-r64p-4869
- Published
- 2026-02-26T19:41:18.762Z
- Modified
- 2026-04-07T15:00:13.656988Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Path Traversal in Local File Store Backend
- Details
-
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Store.Local' module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines 'Elixir.Hexpm.Store.Local':get/3, 'Elixir.Hexpm.Store.Local':put/4, 'Elixir.Hexpm.Store.Local':delete/2, 'Elixir.Hexpm.Store.Local':delete_many/2.
This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.
This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.
Workaround
- Avoid the local file store backend in any exposed environment.
- Restrict network access to the registry when using the local backend.
- Production deployments should use object storage (e.g., S3-compatible backends) instead of the local filesystem store.
Configuration
Only self-hosted hexpm deployments using the Hexpm.Store.Local storage backend are affected. The hex.pm service and deployments using S3-compatible object storage backends are not affected.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "capec_ids": [ "CAPEC-139" ], "cpe_ids": [ "cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*" ] }- References
- Credits
-
-
- Michael Lubas / Paraxial.io - FINDER
-
- Jonatan Männchen / EEF - REMEDIATION_DEVELOPER
-
- Eric Meadows-Jönsson / Hex.pm - REMEDIATION_REVIEWER
-